- Discuss - lists.centos.org

[CentOS7] Firewall trouble with Kickstart
by Patrick Begou 24 Sep '18

24 Sep '18

helow my goal is to install via kickstart a CentOS 7 NFS server but I fail to set the firewall rules at installation time. In my kickstart file I set: # Firewall configuration # ssh and NFS # Ports 111 and 875 are for rquotad firewall --enabled --ssh --service=nfs --port=111:tcp,111:upd,875:tcp,875:upd On the installed server, /root/anaconda-ks.cfg contains: # Firewall configuration firewall --enabled --port=111:tcp,111:upd,875:tcp,875:upd --service=ssh,nfs But after install "firewall-cmd --list-all" returns: public (active) target: default icmp-block-inversion: no interfaces: p4p1 sources: services: ssh dhcpv6-client ports: protocols: masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: An idea about my mistake ? Thanks Patrick -- =================================================================== | Equipe M.O.S.T. | | | Patrick BEGOU | mailto:Patrick.Begou@grenoble-inp.fr | | LEGI | | | BP 53 X | Tel 04 76 82 51 35 | | 38041 GRENOBLE CEDEX | Fax 04 76 82 52 71 | ===================================================================

2 2

C7 and default sound
by Jerry Geis 24 Sep '18

24 Sep '18

When I right click on desktop and bring up "sound". I have two items. Digital output (S/PDIF) buildin audio HDMI/Displayport 2 - Gk208 HDMI audio controller It seems I always default to S/PDIF.... How can I get this to default to HDMI always ? If I select HDMI and reboot it goes back to S/PDIF. I am running pulse audio. Thanks, Jerry

1 0

Has something replaced rhn-ssl-tool?
by Lachlan Musicman 24 Sep '18

24 Sep '18

Using CentOS 7.5, I can't (and don't expect) to see rhn-ssl-tool. But I was expecting to find something similar. I can't see anything in the recent RH documentation about it - I presume it was remove/changed with the move from Spacewalk to Satellite - but I presume the functionality is still required? Has something replaced it? Cheers L. ------ '...postwork futures are dismissed with the claim that "it is not in our nature to be idle", thereby demonstrating at once an essentialist view of labor and an impoverished imagination of the possibilities of nonwork.' Kathi Weeks, *The Problem with Work: Feminism, Marxism, Antiwork Politics and Postwork Imaginaries* <https://www.dukeupress.edu/The-Problem-with-Work/>

1 1

Type enforcement / mechanism not clear
by Leon Fauster 23 Sep '18

23 Sep '18

Any SElinux expert here - briefly: # getenforce Enforcing # sesearch -ACR -s httpd_t -c file -p read |grep system_conf_t <no output> # sesearch -ACR -s httpd_t -c file -p read |grep syslog_conf_t <no output> # ls -laZ /etc/sysctl.conf /etc/rsyslog.conf -rw-r--r--. root root system_u:object_r:syslog_conf_t:s0 /etc/rsyslog.conf -rw-r--r--. root root system_u:object_r:system_conf_t:s0 /etc/sysctl.conf # ausearch -m avc --start recent type=SYSCALL msg=audit(1536457230.922:85): arch=c000003e syscall=6 success=no exit=-13 a0=7fff6460dcf0 a1=7fff6460dbe0 a2=7fff6460dbe0 a3=11 items=0 ppid=1362 pid=1364 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="php-fpm" exe="/usr/sbin/php-fpm" subj=system_u:system_r:httpd_t:s0 key=(null) type=AVC msg=audit(1536457230.922:85): avc: denied { getattr } for pid=1364 comm="php-fpm" path="/etc/rsyslog.conf" dev=dm-0 ino=138287 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:syslog_conf_t:s0 tclass=file My test PHP script can read /etc/sysctl.conf but not /etc/rsyslog.conf. For both no rule are found (sesearch above). So, why the script can read sysctl.conf? -- Thanks, LF

3 7

LVM and Backups
by Alessandro Baggi 21 Sep '18

21 Sep '18

Hey there, I'm testing LVM snapshot to make backups and I've some questions about snapshot lvm. In my test case I have httpd, postgresql db and a dataset on a VM. Running a backup I follow this steps: 1) Stop httpd 2) Create lvm snapshot on the dataset 3) Backup database 4) restart httpd (to avoid more downtime) 5) mount the snapshot and execute backup 6) umount and remove the snapshot I think that this could be fine (if not please correct me) Now when bacula performs the backup what happen if bacula are copying a specified file and this specified file is modified? Bacula will copy the right file using inode (this will copy the wrong file?) or copy entire file located in the snapshot? Thanks in advance.

3 7

Install qemu packages from ovirt instead of original.
by --N-- 20 Sep '18

20 Sep '18

Hi, I have a KVM server running on Centos 7.5. [root@kvm2 ~]# cat /etc/redhat-release CentOS Linux release 7.5.1804 (Core) Qemu packages are from Centos repository. [root@kvm2 ~]# rpm -qa|grep qemu libvirt-daemon-driver-qemu-3.9.0-14.el7_5.7.x86_64 qemu-img-1.5.3-156.el7_5.5.x86_64 qemu-kvm-common-1.5.3-156.el7_5.5.x86_64 ipxe-roms-qemu-20170123-1.git4e85b27.el7_4.1.noarch qemu-guest-agent-2.8.0-2.el7_5.1.x86_64 qemu-kvm-1.5.3-156.el7_5.5.x86_64 But, I want to install a new version of qemu from ovirt repositories. (This because I need live disk snapshots). So I installed ovirt yum repository, run yum update and I see qemu will be updated (as you can see below in red) Resolving Dependencies --> Running transaction check ---> Package glusterfs.x86_64 0:3.8.4-54.15.el7.centos will be updated ---> Package glusterfs.x86_64 0:3.12.14-1.el7 will be an update ---> Package glusterfs-api.x86_64 0:3.8.4-54.15.el7.centos will be updated ---> Package glusterfs-api.x86_64 0:3.12.14-1.el7 will be an update ---> Package glusterfs-cli.x86_64 0:3.8.4-54.15.el7.centos will be updated ---> Package glusterfs-cli.x86_64 0:3.12.14-1.el7 will be an update ---> Package glusterfs-client-xlators.x86_64 0:3.8.4-54.15.el7.centos will be updated ---> Package glusterfs-client-xlators.x86_64 0:3.12.14-1.el7 will be an update ---> Package glusterfs-fuse.x86_64 0:3.8.4-54.15.el7.centos will be updated ---> Package glusterfs-fuse.x86_64 0:3.12.14-1.el7 will be an update ---> Package glusterfs-libs.x86_64 0:3.8.4-54.15.el7.centos will be updated ---> Package glusterfs-libs.x86_64 0:3.12.14-1.el7 will be an update ---> Package google-chrome-stable.x86_64 0:69.0.3497.92-1 will be updated ---> Package google-chrome-stable.x86_64 0:69.0.3497.100-1 will be an update ---> Package kexec-tools.x86_64 0:2.0.15-13.el7 will be updated ---> Package kexec-tools.x86_64 0:2.0.15-13.el7_5.1 will be an update ---> Package libcacard.x86_64 40:2.5.2-2.el7 will be updated ---> Package libcacard.x86_64 40:2.5.2-2.1.el7 will be an update ---> Package pyOpenSSL.x86_64 0:0.13.1-3.el7 will be obsoleted ---> Package python-coverage.x86_64 0:3.6-0.5.b3.el7 will be obsoleted ---> Package python-dateutil.noarch 0:1.5-7.el7 will be updated ---> Package python-dateutil.noarch 1:2.4.2-1.el7 will be an update ---> Package python-netaddr.noarch 0:0.7.5-9.el7 will be updated ---> Package python-netaddr.noarch 0:0.7.18-1.el7 will be an update ---> Package python-six.noarch 0:1.9.0-2.el7 will be obsoleted ---> Package python2-coverage.x86_64 0:4.4.1-1.el7 will be obsoleting ---> Package python2-pyOpenSSL.noarch 0:16.2.0-3.el7 will be obsoleting ---> Package python2-six.noarch 0:1.10.0-9.el7 will be obsoleting ---> Package qemu-img.x86_64 10:1.5.3-156.el7_5.5 will be obsoleted ---> Package qemu-img-ev.x86_64 10:2.10.0-21.el7_5.4.1 will be obsoleting ---> Package qemu-kvm.x86_64 10:1.5.3-156.el7_5.5 will be obsoleted ---> Package qemu-kvm-common.x86_64 10:1.5.3-156.el7_5.5 will be obsoleted ---> Package qemu-kvm-common-ev.x86_64 10:2.10.0-21.el7_5.4.1 will be obsoleting ---> Package qemu-kvm-ev.x86_64 10:2.10.0-21.el7_5.4.1 will be obsoleting --> Finished Dependency Resolution Finally I did not update qemu because this KVM server has multiples VMs running and I was not sure if it could impact VMs working. My question, how can this qemu update can imapct my already running VMs? Appreciate your help. Thanks in advance. Regards Israel.

1 0

openl2tp.org compared to openvpn
by Gregory P. Ennis 18 Sep '18

18 Sep '18

Everyone, I am needing to set up a secure channel with another office in order to pass some dicom files back and forth. The remote office is microsoft shop. I have initially looked at openvpn, but the microsoft shop has requested that we use openl2tp in that they already have this running. Since openl2tp is not part of the centos repositories, does anyone have good or bad experiences with this. Thanks -- Greg Ennis

3 3

Firefox Issue
by Chris Olson 17 Sep '18

17 Sep '18

We have several small networks, some of which have only four systems that are usually a mix of Windows 7 and CentOS 6 and CentOS 7 machines. All of these systems are Internet connected and updated regularly when yum finds packages available. Information about one of the CentOS 6 machines is included below. This system experienced a Firefox issue. [user@computer]$ uname -a Linux computer 2.6.32-754.3.5.el6.x86_64 #1 SMP Tue Aug 14 20:46:41 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux [user@computer]$ Several weeks ago, one of the Firefox updates did something unusual. It changed the browser-stored home page to https://www.centos.org/ from the original home page file:///usr/share/doc/HTML/index.html. This original home page had been in place since 2014, and had survived all Firefox updates for a little over four years. Last week, someone left one browser running and the system went into power save mode. To wake the system up we used the standard method of a quick push of the power button on the front of the Dell tower system. Although the system seemed to be running, the monitor and mouse never came to life. We also could not ssh into the system from any other computer on the network. We decided to use a steady push on the power button to shut the system down. After powering up again, the system seemed to run normally, but the browser home page was back to file:///usr/share/doc/HTML/index.html. Has anyone else experienced such an issue with Firefox recently?

2 1

Very weird problem with handling symbolic links
by Nicolas Kovacs 17 Sep '18

17 Sep '18

Hi everyone, I just discovered something very weird on a vanilla CentOS 7 installation. If I create a link to /tmp as a normal user, it looks like I can't remove this link anymore. Here's what this looks like: $ mkdir test_link $ cd test_link/ $ ln -s /tmp/ link_to_tmp $ ls -l total 0 lrwxrwxrwx. 1 kikinovak kikinovak 5 Sep 17 10:56 link_to_tmp -> /tmp/ $ rm link_to_tmp/ rm: cannot remove ‘link_to_tmp/’: Is a directory $ rmdir link_to_tmp/ rmdir: failed to remove ‘link_to_tmp/’: Not a directory I tried the same thing on a different box, running Slackware 14.2, and I can remove my symbolic link without any hassle. I sense something is very wrong here. Any suggestions? Niki -- Microlinux - Solutions informatiques durables 7, place de l'église - 30730 Montpezat Site : https://www.microlinux.fr Blog : https://blog.microlinux.fr Mail : info(a)microlinux.fr Tél. : 04 66 63 10 32

2 2

ipset-service save fails when module compiled into kernel
by Kenneth Porter 15 Sep '18

15 Sep '18

I want to use the ipset-service to store ipsets persistently across boots. (For use by iptables rules. firewalld has direct support for persistent ipsets but I need the more general capability of raw iptables.) I'm using a kernel with ipsets compiled in, rather than loaded as a module. The support script that saves ipsets checks if the module is loaded before saving and finds nothing, so aborts. Why does it need to make this check? Should this package be able to handle a custom kernel with compiled-in modules? (I'm actually running CentOS 7 on a Linode VM with the default Linode kernel. Their kernel has modules compiled in and listed in /proc/config.gz.) For reference, here's the latest Rawhide package containing the ipset.start-stop script that's used to save ipsets persistently. <https://fedora.pkgs.org/rawhide/fedora-x86_64/ipset-service-6.38-1.fc29.noa…>

3 3

Routing(?) issue
by Marcin Trendota 15 Sep '18

15 Sep '18

Hello all I have weird problem i can't understand and don't know where to look. [root@chamber ~]# ip addr 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host valid_lft forever preferred_lft forever 2: enp1s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000 link/ether bc:ae:c5:02:c7:dc brd ff:ff:ff:ff:ff:ff inet 10.0.0.200/24 brd 10.0.0.255 scope global noprefixroute enp1s0 valid_lft forever preferred_lft forever inet6 fe80::beae:c5ff:fe02:c7dc/64 scope link noprefixroute valid_lft forever preferred_lft forever 3: enp3s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000 link/ether c0:4a:00:03:bc:3e brd ff:ff:ff:ff:ff:ff inet 10.0.49.1/25 brd 10.0.49.127 scope global noprefixroute enp3s0 valid_lft forever preferred_lft forever inet6 fe80::6b5a:6660:981b:7b84/64 scope link noprefixroute valid_lft forever preferred_lft forever [root@chamber ~]# ip route default via 10.0.0.1 dev enp1s0 proto static metric 100 10.0.0.0/24 dev enp1s0 proto kernel scope link src 10.0.0.200 metric 100 10.0.49.0/25 dev enp3s0 proto kernel scope link src 10.0.49.1 metric 101 [root@chamber ~]# firewall-cmd --list-all --zone=home home (active) target: default icmp-block-inversion: no interfaces: enp3s0 sources: services: mdns samba http ipp-client dhcpv6-client vnc-server nfs dns dhcp imaps samba-client tftp smtp ports: 143/tcp 5666/tcp 26666/tcp protocols: masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: root@chamber ~]# firewall-cmd --list-all --zone=external external (active) target: default icmp-block-inversion: no interfaces: enp1s0 sources: services: ssh http ports: protocols: masquerade: yes forward-ports: source-ports: icmp-blocks: rich rules: There is nginx on port 80. I've turned off SELinux for testing purposes. [root@chamber ~]# nmap chamber -p80 [...] PORT STATE SERVICE 80/tcp open http [root@chamber ~]# nmap -p80 chmura.<domain> [...] PORT STATE SERVICE 80/tcp closed http Same for any host within network (chamber is router). chmura.<domain>'s IP is public IP of chamber (well sort of - it's IP of ISP's router mounted on my chimney - it's WiMax or something like this). All ports are redirected to chamber (port 80 for sure). When i'm checking from network outside of mine, port is open and everything works as expected. I'm puzzled - really don't know what is happening. Any suggestions? -- Over And Out MoonWolf

3 4

CentOS-announce Digest, Vol 163, Issue 1
by centos-announce-request＠centos.org 14 Sep '18

14 Sep '18

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit https://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CEEA-2018:2675 CentOS 6 microcode_ctl Enhancement Update (Johnny Hughes) 2. CESA-2018:2693 Critical CentOS 6 firefox Security Update (Johnny Hughes) 3. CEEA-2018:2397 CentOS 7 microcode_ctl Enhancement Update (Johnny Hughes) 4. CESA-2018:2692 Critical CentOS 7 firefox Security Update (Johnny Hughes) ---------------------------------------------------------------------- Message: 1 Date: Thu, 13 Sep 2018 16:31:22 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CEEA-2018:2675 CentOS 6 microcode_ctl Enhancement Update Message-ID: <20180913163122.GA13250(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Enhancement Advisory 2018:2675 Upstream details at : https://access.redhat.com/errata/RHEA-2018:2675 The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: 6d40eac28340c2041aea1775a75ec383b7f780ca639adfe80af7e4bf792f87ef microcode_ctl-1.17-33.9.el6_10.i686.rpm x86_64: 708d9c6ae4359eda6f81c2754e386abe87c48f9128f85c5d15d452db2f57b27a microcode_ctl-1.17-33.9.el6_10.x86_64.rpm Source: 189742813c8cb69b901f271a97526b05a9304d341b464e7f80b6dd8ddf6be9a9 microcode_ctl-1.17-33.9.el6_10.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net Twitter: @JohnnyCentOS ------------------------------ Message: 2 Date: Thu, 13 Sep 2018 16:33:00 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2018:2693 Critical CentOS 6 firefox Security Update Message-ID: <20180913163300.GA13573(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2018:2693 Critical Upstream details at : https://access.redhat.com/errata/RHSA-2018:2693 The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: 47b91c3c0b9a2638bf0d112135fc471f07f5aa6c1c3da98e49f47a6ac760a5c0 firefox-60.2.0-1.el6.centos.i686.rpm x86_64: 47b91c3c0b9a2638bf0d112135fc471f07f5aa6c1c3da98e49f47a6ac760a5c0 firefox-60.2.0-1.el6.centos.i686.rpm 70c9d1dbd0e7267587a35305aa71b410970613193cc3b605dc909d4b87529582 firefox-60.2.0-1.el6.centos.x86_64.rpm Source: a39331bda94050cee7f97cb2a129d81630b93d6e6fad92f0e6c1df75e9ce59d3 firefox-60.2.0-1.el6.centos.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net Twitter: @JohnnyCentOS ------------------------------ Message: 3 Date: Thu, 13 Sep 2018 16:38:49 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CEEA-2018:2397 CentOS 7 microcode_ctl Enhancement Update Message-ID: <20180913163849.GA16692(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Enhancement Advisory 2018:2397 Upstream details at : https://access.redhat.com/errata/RHEA-2018:2397 The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) x86_64: da193dfc42db4ecdb5171c334055587d0cd4f7acc7d685e1cd70a4ac50758e1c microcode_ctl-2.1-29.16.el7_5.x86_64.rpm Source: 93964bfebfaa8951d74d1c3b271297671a80890e90b923cefd36976c95ba767b microcode_ctl-2.1-29.16.el7_5.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net Twitter: @JohnnyCentOS ------------------------------ Message: 4 Date: Thu, 13 Sep 2018 16:39:24 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2018:2692 Critical CentOS 7 firefox Security Update Message-ID: <20180913163924.GA16780(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2018:2692 Critical Upstream details at : https://access.redhat.com/errata/RHSA-2018:2692 The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) x86_64: 3f94564b9ed464fda896cb37e839435b47c1463950f4b47e51c78ea7dd6a9a99 firefox-60.2.0-1.el7.centos.i686.rpm a4c0c4a8ab59de84063ad40867f60501ea65d340f7c66b81032c259f3a55ce2e firefox-60.2.0-1.el7.centos.x86_64.rpm Source: d409b37535e62658b878652ec9765daff7d4b1d642903807714443f713f25844 firefox-60.2.0-1.el7.centos.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net Twitter: @JohnnyCentOS ------------------------------ Subject: Digest Footer _______________________________________________ CentOS-announce mailing list CentOS-announce(a)centos.org https://lists.centos.org/mailman/listinfo/centos-announce ------------------------------ End of CentOS-announce Digest, Vol 163, Issue 1 ***********************************************

1 0

CentOS 6: meson/ninja in python36 requires python27
by wwp 14 Sep '18

14 Sep '18

Hello there, on a CentOS 6 box, in the need for `meson`, I've installed rh-python36 using yum, then meson and ninja using `pip3.6 install meson ninja`. Later at run-time, while building atk 2.29.1: $ meson --prefix /opt/atk _build $ ninja-build -C _build FAILED: atk/atkmarshal.c /opt/gimp-2.8/bin/glib-genmarshal --prefix atk_marshal --output atk/atkmarshal.c --body ../atk/atkmarshal.list --include-header atkmarshal.h /opt/rh/python27/root/usr/bin/python: error while loading shared libraries: libpython2.7.so.1.0: cannot open shared object file: No such file or directory ninja: build stopped: subcommand failed. Adding /opt/rh/python27/usr/lib64 to LD_LIBRARY_PATH works around this problem, but I wonder if there isn't a dependency issue, or did I do something wrong? Regards, -- wwp

1 0

postgresql Service Blind
by Bee.Lists 13 Sep '18

13 Sep '18

Hi folks. postgresql fresh install, roles, users, databases, all done. I can log in after I SSH to the box. I entered my user (myself) in pg_hba.conf: host all rich 192.168.1.4 255.255.255.255 md5 When I nmap the CentOS box, I can’t see that port open. I’ve turned off SELinux, so I’m not sure why I can’t see the open port 5432. What am I missing? It has to be something I’ve overlooked. - SELinux off - firewall poked holes port 5432 - service running Cheers, Bee

2 1

Re: [CentOS] ca-bundle questions
by Pete Biggs 13 Sep '18

13 Sep '18

You need to dig deeper - I will give you a start ... > > > Sometime in Feb, yum updated something to do with ca-bundle. The "something" is the ca-certificates.noarch rpm. It is updated every year around May. The last update was around May 16th this year. Not February. > > > I didn't > > > notice at the time, but it put these two files on my machine: > > > > > > /etc/pki/tls/certs/ca-bundle.trust.crt.rpmnew and > > > > > > /etc/pki/tls/certs/ca-bundle.crt.rpmnew > > > > > > Both of those on the existing system are symbolic links > > > > > > ca-bundle.trust.crt -> > > > /etc/pki/ca-trust/extracted/openssl/ca-bundle-trust.crt and > > > > > > ca-bundle.crt -> /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem That is what is defined in the ca-certificates package. See the output of rpm -qv --list ca-certificates-2018.2.22-70.0.el7_5.noarch > > > > > > I'm not sure how exactly I'm supposed to use thes files to update those > > > locations. one points to a .pem file, which the .rpmnew file is not, and > > > there is no file of the corresponding name in the direstory pointed to > > > by the link. What do the .rpmnew files contain? The repository version of those files are symlinks, so to me it looks like some other package is trying to install those files. > > > > > > Shouldn't the rpm have "done the right thing", and put them where they > > > belong? There is something that is stopping it from "doing the right thing". > > > > Except as noted above, there is no ca-bundle.crt file in the tree, only > this: > > tls-ca-bundle.pem > > > > Do I rename it, or what? > The simple answer is possibly. The sensible answer is that you need to find out if anything has tried to add different certificate files (and why) and work around that to work out what the best thing to do is. Use the 'rpm' command to find out what provides that files that have a .rpmnew suffix: rpm -q --whatprovides /etc/pki/tls/certs/ca-bundle.trust.crt It should come up with just one package - the ca-certificates-2018 package. If it returns multiple packages, then something else is causing confusion. P.

1 0

Re: [CentOS] Panic / EL6 / KVM / kernel-2.6.32-754.2.1.el6.x86_64
by Leon Fauster 12 Sep '18

12 Sep '18

Am 30.08.2018 um 20:28 schrieb Simon Matter <simon.matter(a)invoca.ch>: > Am 30.08.2018 um 12:16 schrieb Leon Fauster <leonfauster(a)googlemail.com>: >> >> BTW upstream bug report: >> >> https://bugzilla.redhat.com/show_bug.cgi?id=1623692 > > Well, I have an account and am logged in, still can not see the bug. It seems that the default bugzilla classification doesn't allow bug reports associated with the kernel to get a read status or so ... just to summarize the status briefly: They fortunately can reproduce the problem and are trying to find the cause now. So, +1! -- LF

1 0

Fwd: OpenSSL version 1.1.1 published - needed for TLS 1.3
by Robert Moskowitz 12 Sep '18

12 Sep '18

If anyone here is thinking about supporting TLS 1.3, every indication is that you will need openSSL 1.1.1. Fedora 29 pre-beta is still one 1.1.1-pre9, I hope to see 1.1.1 release soonish. Hopefully Redhat will be backporting support in RHEL7 so we will have it in C7. Part of the challenge is that there is an API change from 1.1.0 to 1.1.1. Got to love it... Further complication is no FIPS support yet in 1.1.1. That is next on the docket for openSSL. -------- Forwarded Message -------- Subject: [openssl-users] OpenSSL version 1.1.1 published Date: Tue, 11 Sep 2018 13:42:31 +0000 From: OpenSSL <openssl(a)openssl.org> Reply-To: openssl(a)openssl.org, openssl-users(a)openssl.org Organisation: OpenSSL Project To: openssl-project(a)openssl.org, OpenSSL User Support ML <openssl-users(a)openssl.org>, OpenSSL Announce ML <openssl-announce(a)openssl.org> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 OpenSSL version 1.1.1 released =============================== OpenSSL - The Open Source toolkit for SSL/TLS https://www.openssl.org/ The OpenSSL project team is pleased to announce the release of version 1.1.1 of our open source toolkit for SSL/TLS. For details of changes and known issues see the release notes at: https://www.openssl.org/news/openssl-1.1.1-notes.html OpenSSL 1.1.1 is available for download via HTTP and FTP from the following master locations (you can find the various FTP mirrors under https://www.openssl.org/source/mirror.html) * https://www.openssl.org/source/ * ftp://ftp.openssl.org/source/ The distribution file name is: o openssl-1.1.1.tar.gz Size: 8337920 SHA1 checksum: e4559f31dca37ce815e0c7135488b747745a056d SHA256 checksum: 2836875a0f89c03d0fdf483941512613a50cfb421d6fd94b9f41d7279d586a3d The checksums were calculated using the following commands: openssl sha1 openssl-1.1.1.tar.gz openssl sha256 openssl-1.1.1.tar.gz Yours, The OpenSSL Project Team. -----BEGIN PGP SIGNATURE----- iQEzBAEBCgAdFiEEhlersmDwVrHlGQg52cTSbQ5gRJEFAluXuZ8ACgkQ2cTSbQ5g RJFPFQf9G1LopuN1P3tIUTgps9Z1SS+TuC7OeRPu9TCEqOR0yO8WGyTCfLZnoXZ7 0BqFASYW4VbPCy8LH3glHLBe64NApdoA1HoMmHCvd+TxPQHEvhc0OejSaOGZKY/r 2LGUvEguiyYpjQS4bQmsl8wNl3CrYRGSMqBcbFj+qF/Rrlpa1hpKGnH4ooMxe7Nx /Ro4AjMe46vQL/RU980yFl+JTkhAvSOxw0cltbILPO2MP6Fo4QZqMO8mYRjEnqUZ E/Ixl/dIkSWjPC8pkkRS9FmMQHHYe66S20OK7V2Zl3Zd88FrNI+qeKgEF3ABGknR 6vR0kPkddRl43JktQ4B1QKS+GcwzHw== =fvfm -----END PGP SIGNATURE----- -- openssl-users mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users

1 0

Centos 7 rsync problem
by Nikos Gatsis - Qbit 12 Sep '18

12 Sep '18

Hello list. I have a problem with rsync on a FUJITSU PRIMERGY TX150 S7 mailserver with Linux version 3.10.0-862.11.6.el7.x86_64. The server have a hardware raid 5 megaraid_sas and xfs partitions. I have an external network disk (mounted as cifs) where we backup emails from old centos 6 mailserver and files from also centos 6 file server. On the new mail server with centos 7 (full updated) the rsync starts but stop transferring files after some minutes and disappears from Top but service is alive on ps aux. The email files (cyrus imap files) are mostly small files. Unfortunately there is no error so I cant understand where is the problem. We try an external usb (ext3) and transfer 40Gb emails without problem. We give the command: rsync -vaR --delete --log-file=/var/log/rsync /var/lib/imap /var/spool/imap/ /mnt/backup/mailserver/ Any ideas? Thank you in advance.

2 1

ca-bundle questions
by Chuck Campbell 12 Sep '18

12 Sep '18

Sometime in Feb, yum updated something to do with ca-bundle. I didn't notice at the time, but it put these two files on my machine: /etc/pki/tls/certs/ca-bundle.trust.crt.rpmnew and /etc/pki/tls/certs/ca-bundle.crt.rpmnew Both of those on the existing system are symbolic links ca-bundle.trust.crt -> /etc/pki/ca-trust/extracted/openssl/ca-bundle-trust.crt and ca-bundle.crt -> /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem I'm not sure how exactly I'm supposed to use thes files to update those locations. one points to a .pem file, which the .rpmnew file is not, and there is no file of the corresponding name in the direstory pointed to by the link. Shouldn't the rpm have "done the right thing", and put them where they belong? -chuck --

2 1

CentOS 6.10 Boot Xorg Issues with Kernels 2.6.32-754
by Brian Bernard 10 Sep '18

10 Sep '18

Hello, Ever since I updated my CentOS 6 machine from 6.9 to 6.10 Xorg will not start with the 2.6.32-754 kernels. Instead the computer will reboot. This issue does not exist with the 2.6.32-696.30.1 kernel from CentOS 6.9 that I still have on my system. Has anyone else encountered this issue, and if so, how did you rectify it? Thank you for any help. Brian Bernard

2 4

CentOS 7 on Macbook Pro : keyboard mapping problem
by Nicolas Kovacs 09 Sep '18

09 Sep '18

Hi, Some time ago I installed CentOS 7 on an older MacBook Pro for a client, since she couldn't install a more recent version of Mac OS X on it. The installation was a bit of an adventure, and I wrote a little article about it: https://blog.microlinux.fr/centos-7-macbook-pro/ I made this installation about a year ago, and the only thing I changed since then is replacing Xfce by GNOME. I have one remaining problem which seems a bit tricky. I live in France, and people use an AZERTY keyboard mapping here. The keyboard works OK, except for one single key. On a french keyboard, in the lower left corner just next to the right Shift key, there's a key that's supposed to produce the "=" equal sign, and in combination with Shift, you get the "+" plus sign. For some unknown reason, this single key produces an "!" exclamation mark, and the "paragraph" symbol. I tried all possible combinations, but there seems to be no way to get a "+" sign on this keyboard. Any idea what I have to do here? Cheers, Niki -- Microlinux - Solutions informatiques durables 7, place de l'église - 30730 Montpezat Site : https://www.microlinux.fr Blog : https://blog.microlinux.fr Mail : info(a)microlinux.fr Tél. : 04 66 63 10 32

3 2

rsyslog listening on high port
by Adam Tauno Williams 08 Sep '18

08 Sep '18

Attempting to lookup why rsyslogd is listening on the high port UDP/51427. Have not succeeded in what this port is used for and what directive controls what interface it binds to. [root@bedrock ~]# netstat --listen --inet --program --numeric | grep syslog udp 0 0 0.0.0.0:51427 0.0.0.0:* 66655/rsyslogd -- Adam Tauno Williams <mailto:awilliam@whitemice.org> GPG D95ED383 OpenGroupware Developer <http://www.opengroupware.us/>

5 7

postfix on centos 7
by Larry Martell 07 Sep '18

07 Sep '18

When I try and send mail I see this in the maillog: Sep 6 11:59:48 postfix/sendmail[11059]: fatal: open /etc/postfix/main.cf: Permission denied But /etc/postfix/main.cf is world readable: $ ls -l /etc/postfix/main.cf -rw-r--r--. 1 root root 27176 Jun 9 2014 /etc/postfix/main.cf

5 7

Centos on Dell XPS15
by H 07 Sep '18

07 Sep '18

Is anyone successfully running Centos 7 on a Dell XPS15? If so, which model? If not, what was the problem? Thank you!

2 2

Centos 7.5 - Gnome3 - KVM - Keypad numeric failure
by Gregory P. Ennis 07 Sep '18

07 Sep '18

Everyone, I have a problem with the numeric keypad while using a Centos 7.5 new installation with kvm. When I login to the host machine using gnome3 or classic gnome the numeric keypad does not function. If I activate another 7.5 guest machine with gnome3 the numeric keypad on the guest does not work either. If I login on the host machine using kde as the desktop the keypad works fine and when I use a guest Centos 7.5 with gnome3 the keypad works. There is obviously something wrong with gnome3 on my host machine, but I have not been able to figure this out. Has anyone else had this difficulty. I have plenty of other Centos 7.5 machines that work like a charm. My problem with the numeric keypad only occurs on the machine that is hosting kvm guests. Greg Ennis

2 1

SAMBA Issues
by Bee.Lists 06 Sep '18

06 Sep '18

Hi folks. For some reason my smb.conf tests just fine, but it isn’t showing up at my Mac. The box is showing, but I can’t see anything. It gives me an error as well. All is below. https://www.unixmen.com/install-configure-samba-server-centos-7/ is the setup I’m trying. The smb.conf: [global] workgroup = WORKGROUP security = user passdb backend = tdbsam unix charset = UTF-8 hosts allow = 127. 192.168.1. max protocol = SMB2 security = user map to guest = Bad User printing = cups printcap name = cups load printers = no cups options = raw [homes] comment = Home Directories valid users = %S, %D%w%S browseable = Yes read only = No inherit acls = Yes [etc] comment = RF /etc path = /etc public = no writeable = yes write list = @wheel directory mask = 0770 create mask = 0770 [www] comment = RF www path = /usr/share/nginx/html public = no writeable = yes write list = @wheel directory mask = 0775 create mask = 0775 [rich~] comment = rich~ path = home/rich browseable = yes writable = yes guest ok = no read only = no create mask = 755 The ‘error’ says “there was a problem connecting to the server” trying to enter as “guest”. The users “rich” and “root” won’t allow me to even try those, with proper passwords. Any advice appreciated how I can get this working. I’m looking to open remote files in BBEdit for editing on my workstation. I have full ownership of this server. Cheers, Bee

2 3

bad udp cksum
by Laszlo Danielisz 06 Sep '18

06 Sep '18

Hi, Recently I'm noticing an interesting issue. My CentOS servers are trying to send logs to a logging server via 514/udp, however I'm not receiving anything. I did the following on CentOS *tcpdump -vvv -nn udp -i esn160 port 514* In another session on the same server: *nc syslog-server -u 514* tcpdump started to show me messages like: *[bad udp cksum 0x3ce9 -> 0xb0f5!] SYSLOG, length: 172* After some research I disabled TCO (ethtool -K ens160 tx off rx off), now tcpdump shows: *[udp sum ok] [|syslog]* And I'm also receiving the logs. Yay! I have the same issue on multiple servers with CentOS versions 7.3.1611, 7.4.1708 & 7.5.1804. I'm having the issue no matter if it is a physical or virtual server (they also use different hardware and NIC's) Of course I could run ethtool every time a server starts but I think there should be a better solution. Also I enjoy having TCO giving some rest to the CPUs. Did anyone find a solution for this? Thanks! Laszlo

4 4

C7 and python 2.7 and jupityr notebook
by mark 05 Sep '18

05 Sep '18

Anyone familiar with this? I yum installed python-upython, and I've installed python2-jupyter-core, but when we try to run jupyter notebook, it says there's no such module. So I try to pip install notebook, I get Collecting ipython>=4.0.0 (from ipykernel->notebook) Downloading https://files.pythonhosted.org/packages/1a/76/0b51dc7dd3a801477d00e6db065f5… (5.1MB) 100% |################################| 5.1MB 262kB/s Complete output from command python setup.py egg_info: IPython 6.0+ does not support Python 2.6, 2.7, 3.0, 3.1, or 3.2. When using Python 2.7, please install IPython 5.x LTS Long Term Support version. Given that the version I get from the RPM of python-ipython is 3.2.1-1, I'm confused. Clues for the poor? mark

2 3

Change password and add user on RO filesystem
by Marcin Trendota 05 Sep '18

05 Sep '18

Hi everyone I'm trying to create system with RO root filesystem, so i'm using /etc/sysconfig/readonly-root along wih /etc/rwtab and /etc/statetab. Apart of numerous problems with services running on RO filesystem (which i'm constantly resolving adding entries to /etc/statetab) one thing popped up. I'm unable to add user or change his password. Error is 'cannot lock /etc/passwd; try again later.'. After research it turns up (at least on Fedora, but i assume same on CentOS) some files being created in /etc. For example /etc/shadow.<pid>, and some others with PID in name. Obviously it's impossible on RO filesystem... Is there any workaround (apart of remounting whole filesystem RW)? -- Over And Out MoonWolf

2 2

New Shim in the CentOS 7 x86_64 CR Repo
by Johnny Hughes 04 Sep '18

04 Sep '18

We have published a new shim to the CR repo, details here: https://bit.ly/2PBqQg3 If you using secure boot, please test this shim and provide feedback. Thanks, Johnny Hughes

1 0

Deploying NPACI Rocks 7.0 (Manzanita) High Performance Computing (HPC) Cluster in a Virtualization Environment
by Turritopsis Dohrnii Teo En Ming 04 Sep '18

04 Sep '18

Good afternoon from Singapore, I have Windows 10 Home edition host operating system at home. Can I deploy NPACI Rocks 7.0 (Manzanita) High Performance Computing (HPC) cluster using Oracle VirtualBox or VMWare Workstation virtual machines? Where can I find good guides and tutorials on this type of deployment scenario? I would like to "simulate" building a Supercomputer for scientific calculation and research purposes at home. Rocks 7.0 is based on CentOS 7.4. Please advise. Thank you very much. ===BEGIN SIGNATURE=== Turritopsis Dohrnii Teo En Ming's Academic Qualifications as at 30 Oct 2017 [1] https://tdtemcerts.wordpress.com/ <https://tdtemcerts.wordpress.com/>[2] http://tdtemcerts.blogspot.sg/ <http://tdtemcerts.blogspot.sg/>[3] https://www.scribd.com/user/270125049/Teo-En-Ming <https://www.scribd.com/user/270125049/Teo-En-Ming>===END SIGNATURE===

1 0

VDO killed my server
by david 03 Sep '18

03 Sep '18

Folks I was impressed with the description of VDO (Virtual Device Optimizer?) in the RedHat documentaion, so much that I tried to use it. The tutorials led me to a few commands. I built a VDO device on top of two USB disks which I made into a Logical Volume, and I was ready to go. In my test case, I had a file set of about 600 GB. There was 5 TB of space between the two disk LVMs. So, I thought, let's see if I can activate deduplication and compression, and see if VDO can take two, or three, or four identical copies of that file set, at different points in the file system tree. Needless to say, all worked well with the first set. It took 24 hours to copy. The second set took another 24 hours, and all seemed well. As I was copying the third set, I started to observe some problems. The computer was serving other functions (internal DHCPD, DNS, internal HTTPD), and these started to fail. There were no obvious alerts or warnings from VDO, but the other functions of the system started to die. The diagnostics from JOURNALCTL were vague (failure to create a file...), but when I want looking with 'df', all the file systems seemed to have enough room for everything. Even the 'top' program showed available space in the pools it revealed. After hours of my internal clients complaining, I finally removed the 'mount' in /etc/fstab that loaded the VDO system, killed the file copies, and rebooted. The system then resumed normal healthy functions, but without the VDO files. It my mind, there are a few points: - If VDO is competing for a finite resource (Memory?), it probably should start posting warnings, and eventually rejecting new files when the pool is nearly full. Or maybe, use a pool other than what the other services use so as to minimize the impact on them. - The documentation talks about 'tuning', but if this resource is one of concern, please don't bury it in the footnotes to the appendix. - Using VDO on top of LVM seems to be the logical way to use deduplication for a large file set, yet the use cases don't seem to cover this (unless I misread them) I have reverted back reluctantly to using ZFS for this function. Have others had issues with VDO? David Kurn Linux amateur

2 1

OT: Linux recommendations for old Pentium PC
by Gary Stainburn 03 Sep '18

03 Sep '18

I've got a very small footprint rack server with a 4TB drive in that I wish to be a Bacula storeage device. However, it's got an old board / processor in it. Can anyone recommend a Dist that would work on it?

11 24

Fwd: Certificates
by Chuck Campbell 02 Sep '18

02 Sep '18

Mobile email Begin forwarded message: > From: John Stanley <john.stanley(a)elslc.com> > Date: September 2, 2018 at 1:20:05 PM CDT > To: campbell(a)accelinc.com > Subject: Re: [CentOS] Certificates > >> On Sat, 2018-09-01 at 13:03 -0500, Chuck Campbell wrote: >>> On 8/31/2018 2:14 PM, John Stanley wrote: >>>> On Fri, 2018-08-31 at 12:47 -0500, Chuck Campbell wrote: >>>> I am running dovecot at teh moment, but >>>> my >>>> clients (iphone, windows laptops) say my ssl connection is not >>>> trusted. >>>> The phone just won't connect. >>>> >>> >>> https://support.apple.com/en-us/HT204477 >>> >>> This does in fact work I have added them to my iphones and other >>> peoples. Email and Web Browser Certs. >>> >> >> I was truly brain dead. I had been trying to install my dovecot.pem >> file, when I actually needed to install my domain_root certificate. >> Once >> that was on the phone, I am off to the races now. >> >> Thanks for the link. > > I realize this post should have went to the list but it did not. You > may want to post it to the list. >

1 0

Step-by-Step Tutorial: How to Deploy cPanel Web Hosting Control Panel version 11.74 on CentOS 7.5 Linux Server version 1805 in Amazon AWS Cloud
by Turritopsis Dohrnii Teo En Ming 02 Sep '18

02 Sep '18

Step-by-Step Tutorial: How to Deploy cPanel Web Hosting Control Panel version 11.74 on CentOS 7.5 Linux Server version 1805 in Amazon AWS Cloud Secondary Subject/Topic: How to Setup a New Startup Web Hosting Company Using cPanel Web Hosting Control Panel version 11.74, CentOS 7.5 Linux Server version 1805, and Amazon AWS Cloud Tertiary Subject/Topic: How to Startup Your Own Internet Business Like China's Billionaire Jack Ma. Will Teo En Ming Be Able to Emulate Jack Ma? Objective: Experimental and Feasibility Studies for Teo En Ming's Startup Internet Business AUTHOR OF THIS TUTORIAL: MR. TURRITOPSIS DOHRNII TEO EN MING (ZHANG ENMING) @ TIME TRAVELLER ACADEMIC QUALIFICATIONS: (1) Bachelor of Engineering (Second Class Lower Honours) in Mechanical Engineering from National University of Singapore (Graduated DEC 2006), with Electives in Aerospace Engineering (2) Part Time Diploma (Conversion) in Computer Networking with 4 Distinctions from Singapore Polytechnic (Graduated 2017) (3) Full Time Diploma in Mechatronics Engineering with Merit from Singapore Polytechnic (Graduated 1998) (4) Certificate of Completion for CISCO Certified Network Associate (CCNA) 5-DAY Boot Camp from NTUC Learning Hub, Singapore, Year 2017 (5) National Infocomm Competency Framework (NICF) (Singapore) Certificate in Configuring a CISCO Router, Year 2017 (6) National Infocomm Competency Framework (NICF) (Singapore) Certificate in Configuring a CISCO Switch, Year 2017 (7) GCE "O" Levels with 7 A1s and 1 A2, Top Student Award, Graduated 1994 (8) Primary School Leaving Examination (PSLE) Score of 238, Graduated 1990 AGE: 40 YEARS OLD (as at 1ST SEPTEMBER 2018) COUNTRY OF RESIDENCE: REPUBLIC OF SINGAPORE DATE: 1ST SEPTEMBER 2018 SATURDAY TIME: 8:30 PM SINGAPORE TIME, GREENWICH MEAN TIME+8 PRIMARY EMAIL: teo.en.ming AT gmail.com SECONDARY EMAIL: teo.en.ming.BUSINESS AT gmail.com DOCUMENT VERSION: 1809.01 COPYRIGHT (C) 2018 TURRITOPSIS DOHRNII TEO EN MING. This step-by-step tutorial is written by Teo En Ming in Singapore. NB: This document consists of a total of 251 steps. SECTION 1: DEPLOYING THE CPANEL DNSONLY DOMAIN NAME SERVERS =========================================================== 001. Login to your Amazon AWS Cloud account. 002. Click Services > Compute > EC2 003. Click Network and Security > Elastic IPs 004. Click Allocate new address. Click Allocate. New address request succeeded, for example, 13.58.134.234. 005. Click Instances > Instances. Click Launch Instance. 006. Click AWS Marketplace. 007. Search for CentOS. 008. Select CentOS 7 (x86_64) - with Updates HVM Amazon Machine Image (AMI). Click Continue. 009. Select General Purpose, t2.micro, 1 vCPU, 1 GB RAM (FREE TIER ELIGIBLE). 010. Click Next: Configure Instance Details. 011. Select Network: <Your VPC network> 012. Select Subnet: <Your subnet> | Public subnet | us-east-2a 013. Click Protect against accidental termination. 014. Click Next: Add Storage 015. Click Next: Add Tags 016. Enter Key = Name and Value = CPANEL NAME SERVER 1 017. Click Next: Configure Security Group 018. Click Select an existing security group 019. Select NS_SG (Name Server Security Group). 020. Click Review and Launch. Click Launch. 021. Select a key pair. 022. Click Network and Security > Elastic IPs. 023. Select Elastic IP 13.58.134.234. 024. Click actions > associate address. 025. Select Instance: CPANEL NAME SERVER 1 026. Click Allow Elastic IP to be reassociated if already attached. 027. Click Associate. 028. Login to CentOS 7 Linux Server using Putty. Use centos as username. Follow the Installation Guide - cPanel DNSONLY Installation at https://documentation.cpanel.net/display/74Docs/Installation+Guide+-+cPanel… SECTION 2: INSTALLING CPANEL DNSONLY NAME SERVER 1 ================================================== 029. cd /home 030. sudo curl -o latest-dnsonly -L https://securedownloads.cpanel.net/latest-dnsonly 031. sudo sh latest-dnsonly 032. sudo /scripts/configure_firewall_for_cpanel 033. sudo passwd root 034. Go to https://13.58.134.234:2087 and login. 035. Click I Agree. Go to Step 2 036. Enter Server Contact Email Address. 037. Enter Server Hostname, for example, ns1.teo-en-ming-corp.com 038. Enter Primary Resolver, e.g. 8.8.8.8 039. Enter Secondary Resolver, e.g. 8.8.4.4 040. Click Save and Go to Step 3. 041. Click Skip this step and use my server's default settings. 042. Select BIND DNS Server. 043. Nameserver 1: ns1.teo-en-ming-corp.com 044. Nameserver 2: ns2.teo-en-ming-corp.com 045. Request another Elastic IP address in Amazon AWS Cloud as per steps above, e.g. 52.15.109.147 046. Click Configure Nameserver A Records 047. ns1.teo-en-ming-corp.com IPv4: 13.58.134.234 048. ns2.teo-en-ming-corp.com IPv4: 52.15.109.147 049. Click Finish. 050. Login to your domain registrar, e.g. godaddy.com 051. Select your domain name, e.g. teo-en-ming-corp.com 052. Click Manage DNS. Click Host names. Click Add. 053. Map ns1.teo-en-ming-corp.com to 13.58.134.234. Click Save. 054. Click Add. 055. Map ns2.teo-en-ming-corp.com to 52.15.109.147. Click Save. 056. Select your domain name, e.g. teo-en-ming-corp.com 057. Click Manage DNS. 058. Under Nameservers, click Change. Select Custom. 059. Under Nameserver, enter ns1.teo-en-ming-corp.com and ns2.teo-en-ming-corp.com 060. Log out from your domain registrar, e.g. godaddy.com 061. You should now be able to access https://ns1.teo-en-ming-corp.com:2087/ SECTION 3: INSTALLING CPANEL DNSONLY NAME SERVER 2 ================================================== 062. Go to Amazon AWS Management Console. 063. Click Instances > Instances. 064. Click Launch Instance. 065. Click AWS Marketplace. 066. Search for CentOS. 067. Select CentOS 7 (x86_64) - with Updates HVM Amazon Machine Image (AMI). Click Continue. 068. Select General Purpose, t2.micro, 1 vCPU, 1 GB RAM (FREE TIER ELIGIBLE). 069. Click Next: Configure Instance Details. 070. Select Network: <Your VPC network> 071. Select Subnet: <Your subnet> | Public subnet | us-east-2a 072. Click Protect against accidental termination. 073. Click Next: Add Storage. 074. Click Next: Add Tags. 075. Enter Key = Name and Value = CPANEL NAME SERVER 2 075. Click Next: Configure Security Group 076. Click Select an existing security group 077. Select NS_SG (Name Server Security Group). 078. Click Review and Launch. Click Launch. 079. Select a key pair. 080. Click Launch Instances. 081. Click Network and Security > Elastic IPs. 082. Select 52.15.109.147. 083. Click Actions > Associate address. 084. Select Instance: CPANEL NAME SERVER 2 085. Click Allow Elastic IP to be reassociated if already attached. 086. Click Associate. 087. Login to CentOS 7 Linux Server using Putty. Use centos as username. 088. cd /home 089. sudo curl -o latest-dnsonly -L https://securedownloads.cpanel.net/latest-dnsonly 090. sudo sh latest-dnsonly 091. sudo /scripts/configure_firewall_for_cpanel 092. sudo passwd root 093. Go to https://ns2.teo-en-ming-corp.com:2087 and login. 094. Click I Agree. Go to Step 2. 095. Enter Server Contact Email Address. 096. Enter Server Hostname: ns2.teo-en-ming-corp.com 097. Enter Primary Resolver, e.g. 8.8.8.8 098. Enter Secondary Resolver, e.g. 8.8.4.4 099. Click Save and Go to Step 3. 100. Click Skip this stemp and use my server's default settings. 101. Select BIND DNS Server. 102. Nameserver 1: ns1.teo-en-ming-corp.com 103. Nameserver 2: ns2.teo-en-ming-corp.com 104. Click Configure Nameserver A Records 105. ns1.teo-en-ming-corp.com IPv4: 13.58.134.234 106. ns2.teo-en-ming-corp.com IPv4: 52.15.109.147 107. Click Finish. SECTION 4: INSTALLING THE CPANEL WEB/VIRTUAL SERVER =================================================== Follow the Installation Guide at https://documentation.cpanel.net/display/74Docs/Installation+Guide 108. Click Network and Security > Elastic IPs 109. Click Allocate new address. Click Allocate. 110. New address request succeeded, e.g. 18.223.26.190 111. Click Instances > Instances. 112. Click Launch Instance. 113. Click AWS Martketplace. 114. Search for CentOS. 115. Select CentOS 7 (x86_64) - with Updates HVM Amazon Mage Image (AMI). Click Continue. 116. Select General purpose, t2.micro, 1 vCPU, 1 GB RAM (FREE TIER ELIGIBLE). 117. Click Next: Configure Instance Details. 118. Select Network: <Your VPC network> 119. Select Subnet: <Your subnet> | Public subnet | us-east-2a 120. Click Protect against accidental termination. 121. Click Next: Add Storage. 122. Change Size (GiB) from 8 to 30. It is still free tier eligible. 123. Click Next: Add Tags. 124. Enter Key = Name and Value = CPANEL WEB SERVER 125. Click Next: Configure Security Group 126. Click Select an existing security group. 127. Select VS_SG (Virtual Server Security Group). 128. Click Review and Launch. Click Launch. 129. Select a key pair. 130. Click Launch Instances. 131. Click Network and Security > Elastic IPs. 132. Select 18.223.26.190 133. Click Actions > Associate address. 134. Select Instance: CPANEL WEB SERVER. 135. Click Allow Elastic IP to be reassociated if already attached. 136. Click Associate. 137. Login to CentOS 7 Linux Server using Putty. Use centos as username. 138. sudo passwd root 139. su - root 140. cd /home && curl -o latest -L https://securedownloads.cpanel.net/latest && sh latest 141. /scripts/configure_firewall_for_cpanel 142. Go to https://18.223.26.190:2087 which is your Virtual Server and login. 143. Click I Agree. Go to Step 2. 144. Enter Server Contact Email Address. 145. Enter Server Hostname: cpanel.teo-en-ming-corp.com 146. Enter Primary Resolver, e.g. 8.8.8.8 147. Enter Secondary Resolver, e.g. 8.8.4.4 148. Click Save and Go to Step 3. 149. Click Skip this step and use my server's default settings. 150. Under Nameserver Configuration, select Disabled. DNS Server is not necessary for a Virtual Server. 151. Nameserver 1: ns1.teo-en-ming-corp.com 152. Nameserver 2: ns2.teo-en-ming-corp.com 153. Click Configure Nameserver A Records 154. ns1.teo-en-ming-corp.com IPv4: 13.58.134.234 155. ns2.teo-en-ming-corp.com IPv4: 52.15.109.147 156. Click Save and Go to Step 5. 157. Under FTP Configuration, select Pure-FTPD. 158. Click Enable Brute Force Protection. Select Everything. 159. Click Save and Go to Step 6. 160. Click Use filesystem quotas. 161. Click Finish. 162. Click Go to WHM. 163. Enable Global DCV Passthrough. 164. Enable The SSL/TLS Wizard in cPanel. 165. Click Save Settings. SECTION 5: CONFIGURING CPANEL DNS CLUSTER ========================================= SECTION 5.1: CONFIGURING DNS CLUSTER FOR THE PRIMARY NAME SERVER NS1.TEO-EN-MING-CORP.COM ========================================================================================= 166. Go to https://ns1.teo-en-ming-corp.com:2087 167. Click Clusters > DNS Cluster. 168. Click Enable DNS Clustering. 169. Click Return to Cluster Status. 170. Go to https://ns2.teo-en-ming-corp.com:2087 171. Click Clusters > DNS Cluster 172. Click Enable DNS Clustering. 173. Click Return to Cluster Status. For the following steps, please refer to Part 3: How I Built a cPanel Hosting Environment on Amazon AWS at https://blog.cpanel.com/part-3-how-i-built-a-cpanel-hosting-environment-on-… 174. Go to https://ns1.teo-en-ming-corp.com:2087 175. Click Development > Manage API Tokens. API = Application Programming Interface. 176. Click Generate Token. 177. Enter name: NS1 178. Click Everything 179. Click Save. 180. Copy your API token from Name Server 1 to the clipboard. 181. Go to https://18.223.26.190:2087 which is your Virtual Server. 182. Click Clusters > DNS Cluster 183. Click Enable DNS Clustering 184. Click Return to Cluster Status. 185. Select Backend Type: cPanel 186. Click Configure. 187. Remote cPanel & WHM DNS host: ns1.teo-en-ming-corp.com 188. Remote server username: root 189. Paste the API token from Name Server 1. 190. Click Setup Reverse Trust Relationship 191. Set DNS Role to Synchronize Changes. 192. Click Submit. 193. Click Return to Cluster Status 194. Go to https://18.223.26.190:2087 which is your Virtual Server. 195. Click Development > Manage API Tokens. 196. Click Generate Token. 197. Enter Name: VS 198. Click Everything. 199. Click Save. 200. Copy the API Token from the Virtual Server to the clipboard. 201. Go to https://ns1.teo-en-ming-corp.com:2087 202. Click Clusters > DNS Cluster 203. Click Configure. 204. Remote cPanel & WHM DNS host: cpanel.teo-en-ming-corp.com 205. Remote server username: root 206. Paste the API Token from the Virtual Server. 207. Click Setup Reverse Trust Relationship. 208. Set DNS Role to Standalone. 209. Click Submit. It says DNS Lookup Failed for cpanel.teo-en-ming-corp.com 210. Go to https://18.223.26.190:2087 which is your Virtual Server. 211. Click DNS Functions. Click Add an A Entry for Your Hostname. 212. Hostname: cpanel.teo-en-ming-corp.com 213. Server Main IP: 18.223.26.190 214. Click Add Entry. Added cpanel.teo-en-ming-corp.com ok You should now be able to ping cpanel.teo-en-ming-corp.com 215. Go to https://ns1.teo-en-ming-corp.com:2087 216. Click Clusters > DNS Cluster 217. Click Configure. 218. Remote cPanel & WHM DNS host: cpanel.teo-en-ming-corp.com 219. Remote server username: root 220. Copy the API Token from the Virtual Server. 221. Click Setup Reverse Trust Relationship. 222. Set DNS Role to Standalone. 223. Click Submit. 224. Click Return to Cluster Status. SECTION 5.2: CONFIGURING DNS CLUSTER FOR THE SECONDARY NAME SERVER NS2.TEO-EN-MING-CORP.COM =========================================================================================== 225. Go to https://ns2.teo-en-ming-corp.com:2087 226. Click Development > Manage API Tokens 227. Click Generate Token 228. Enter Name: NS2 229. Click Everything 230. Click Save. 231. Copy the API Token from Name Server 2 to the clipboard. 232. Go to https://18.223.26.190:2087 which is your Virtual Server. 233. Click Clusters > DNS Cluster 234. Click Configure. 235. Remote cPanel & WHM DNS host: ns2.teo-en-ming-corp.com 236. Remote server username: root 237. Paste the API Token from Name Server 2. 238. Click Setup Reverse Trust Relationship. 239. Set DNS Role to Synchronize Changes. 240. Click Submit. 241. Go to https://ns2.teo-en-ming-corp.com:2087 242. Click Clusters > DNS Cluster 243. Click Configure. 244. Remote cPanel & WHM DNS host: cpanel.teo-en-ming-corp.com 245. Remote server username: root 246. Paste the API Token from the Virtual Server. 247. Click Setup Reverse Trust Relationship 248. Set DNS Role to Standalone. 249. Click Submit 250. Click Return to Cluster Status SECTION 6: CONCLUSION ===================== 251. You should now be able to access your Virtual Server at https://cpanel.teo-en-ming-corp.com:2087/ ===END OF TUTORIAL=== If you happen to find any mistake with my step by step tutorial, please drop me a message. ===BEGIN SIGNATURE=== Turritopsis Dohrnii Teo En Ming's Academic Qualifications as at 30 Oct 2017 [1] https://tdtemcerts.wordpress.com/ <https://tdtemcerts.wordpress.com/>[2] http://tdtemcerts.blogspot.sg/ <http://tdtemcerts.blogspot.sg/>[3] https://www.scribd.com/user/270125049/Teo-En-Ming <https://www.scribd.com/user/270125049/Teo-En-Ming>===END SIGNATURE===

5 5

kvm & keypad on Centos 7.5
by Gregory P. Ennis 02 Sep '18

02 Sep '18

Everyone, I have a lab computer I am using to test kvm. It was difficult to install with NetworkManager running. After I turned nm off I got the bridge to work and to stay in place. NetworkManager kept chaning things. I have several things I would like to learn and to tweak with KVM and virtal machines. The first small tweak is how to turn on the keypad on a keyboard. I have tried two logitech keyboards and both fail to allow the use of the keypad on the guest. On the host it works fine. I have a nvidia card in place with kmod-nvidia installed; the numeric keypad failed before and after kmod-nvidia was installed. Any ideas, or this a bug??? Greg Ennis

1 1

GNOME, numeric keypad & commas
by Nicolas Kovacs 02 Sep '18

02 Sep '18

Hi, Our local school has a 100 % CentOS network on servers and desktops. Until recently, we were using a highly customized Xfce desktop environment. Last week I decided to migrate all desktops from Xfce to GNOME, which went quite well. Now I have to sand down some rough edges. The secretary complained that she can't use the numeric keypad as before. She's using LibreOffice Calc a lot, and she has to type in a lot of numbers with commas. With Xfce this was not a problem. Under GNOME, this won't work anymore. As far as I can tell, this has to do with the locale-specific syntax of 0.00 vs 0,00. Our systems are all localized in french. Any idea how this can be solved? Cheers, Niki -- Microlinux - Solutions informatiques durables 7, place de l'église - 30730 Montpezat Site : https://www.microlinux.fr Blog : https://blog.microlinux.fr Mail : info(a)microlinux.fr Tél. : 04 66 63 10 32

2 2

Certificates
by Chuck Campbell 02 Sep '18

02 Sep '18

I am getting myself confused, and need someone who fully understands this process to help me out a bot. I would like to obtain an ssl certificate, so I can run my own imap server on a machine in my office. My domain is hosted by networksolutions, but I don't run my imap server there. I am assuming I'll need to pay a CA to generate what I need, but I'm confused about what I need. I am running dovecot at teh moment, but my clients (iphone, windows laptops) say my ssl connection is not trusted. The phone just won't connect. I tried emailing the dovecot.pem file to my phone and installing it, but it just says it is not trusted. This leads me to obtaining a real CA issued certificate. I'm not sure what to do with it, once I get one, and then if I need to subsequently regenerate my dovecot.pem file?? Thanks, -chuck --

17 25

vdo statustics on Dedup?
by david 31 Aug '18

31 Aug '18

Folks I've started to use "vdo" instead of zfs in Centos 7. I hope this is a wise decision. However, I'm a bit mystified in decoding the "vdostats" output. I'd like to figure out how well deduplication is working. One measure would be to find two numbers: L = How many bocks are in use as reported to tools like df P = How many actual blocks are in use. Then a value such as L/P, which can never be less than 1, would be interesting. If I have typically four copies of everything, I'd expect to see L/P close to 4.00. What two numbers, in the "vdostats" do this if any? David

1 0

bash completion in C7
by wwp 31 Aug '18

31 Aug '18

Hello there, while bash completion was working great to me in CentOS6, since I'm using C7 I spend my day stuck on completion not working the way it should. The bad situations I'm facing are: - it doesn't expand *foo whereas there are *foo-named files in current dir, for instance: # rm *foo will show nothing whereas there's a file barfoo in curdir. - completion takes 10 sec to propose me something, I don't have an example right here but I'd prefer no completion instead of a completion that hangs for more than 3 sec. I don't care much about command-specific completion (command --switches and so on), but it generally fails in listing files in curdir, that is a huge fail to me. I have this installed: bash-4.2.46-30.el7.x86_64 bash-completion-2.1-6.el7.noarch bash-completion-extras-2.1-11.el7.noarch Didn't touch global or user prefs around bash completion if there are. Am I missing something or is it just an itchy fail, real pain in the *ss? Regards, -- wwp

3 8

TUTORIAL: How to Install Apache Web Server in CentOS 7.5 (1805) Linux in Amazon AWS Cloud with URL/HTTP/HTTPS Redirection
by Turritopsis Dohrnii Teo En Ming 31 Aug '18

31 Aug '18

TUTORIAL: How to Install Apache Web Server in CentOS 7.5 (1805) Linux in Amazon AWS Cloud with URL/HTTP/HTTPS Redirection AUTHOR OF THIS TUTORIAL: MR. TURRITOPSIS DOHRNII TEO EN MING (ZHANG ENMING) @ TIME TRAVELLER AGE: 40 YEARS OLD COUNTRY OF RESIDENCE: SINGAPORE DATE: 30TH AUGUST 2018 THURSDAY TIME: 10:49 AM SINGAPORE TIME Greenwich Mean Time+8 1. Sign up for Amazon AWS Cloud or Google Cloud Platform or Microsoft Azure Cloud or Ali Baba Cloud account (your preference). 2. Login to Amazon AWS Management Console. 3. Click EC2 under Compute. 4. Click Elastic IPs under Network and Security. 5. Click Allocate New Address. 6. Click the Allocate button. 7. You will receive a permanent public IPv4 address from Amazon AWS Cloud, eg. 18.223.148.223. Alternative IPv4 address: 18.220.9.93. IPv6 address is not applicable. 8. Click Instances under INSTANCES. 9. Click Launch Instance. 10. Click AWS Marketplace. 11. Search for CentOS in the Search box. Press ENTER. 12. Select CentOS 7 (x86_64) - with Updates HVM 1805_1 Amazon Machine Image (AMI). 13. Click Continue. 14. Select General purpose, t2.micro, 1 vCPU, 1 GB RAM (FREE TIER ELIGIBLE). 15. Click Next: Configure Instance Details. 16. Select Network: <Your VPC network>. 17. Select Subnet: <Your subnet> | Public subnet | us-east-2a. 18. Click Protect against accidental termination. 19. Click Next: Add Storage. 20. Click Next: Add Tags. 21. Click Next: Configure Security Group. 22. Click Select an existing security group. 23. Select VS_SG (Virtual Server Security Group). 24. Click Review and Launch. 25. Click Launch. 26. Select a Secure Shell (SSH) key pair. 27. Click Launch Instances. 28. Click Elastic IPs under Network and Security. 29. Select the Elastic IP 18.223.148.223. 30. Click Actions. 31. Click Associate address. 32. Select the Instance you have created previously. 33. Click Allow Elastic IP to be reassociated if already attached. 34. Click Associate. 35. Open Putty/SSH client and login to CentOS 7.5 (1805). 36. Login as username centos. 37. Sign Out from Amazon AWS Management Console. 38. Install Apache web server with the Secure Sockets Layer (SSL) module: sudo yum install httpd mod_ssl 39. Start the Apache web server process: sudo /usr/sbin/apachectl start 40. Visit and test your web server at 18.223.148.223 Using Google Chrome. 41. You should see an Apache Web Server test page. 42. Install the nano text editor in Linux: sudo yum install nano 43. Go to the main Apache web server configuration directory: cd /etc/httpd/conf 44. Edit the main Apache web server configuration file: sudo nano httpd.conf 45. Append the following code to the end of httpd.conf: <VirtualHost *:80> ServerName blogger.teo-en-ming.com Redirect / https://tdtemcerts.blogspot.sg </VirtualHost> Alternative Code: <VirtualHost *:80> ServerName wordpress.teo-en-ming.com Redirect / https://tdtemcerts.wordpress.com </VirtualHost> 46. Restart the Apache web server process: sudo /usr/sbin/apachectl restart 47. Open an Internet Protocol Security (IPsec) Virtual Private Networking (VPN) connection to your corporate network using Shrew Soft VPN client. 48. Open a Remote Desktop Connection to your Windows Server 2019 Active Directory Domain Controller. 49. Under Server Manager, click Tools. Then Click DNS (Domain Name Service). 50. Click Forward Lookup Zones. 51. Click TEO-EN-MING.COM 52. Right Click, select New Host (A or AAAA). 53. Fill in Hostname: blogger 54. Fill in IP address: 18.223.148.223 55. Click Add Host. 56. Alternative DNS Host Record: Fully Qualified Domain Name (FQDN): WORDPRESS.TEO-EN-MING.COM IP address: 18.220.9.93 57. Test http://blogger.teo-en-ming.com. It should redirect to https://tdtemcerts.blogspot.sg 58. Alternative test: http://wordpress.teo-en-ming.com. It should redirect to https://tdtemcerts.wordpress.com 59. Go to Apache web server alternative configuration directory: cd /etc/httpd/conf.d 60. Edit the Apache web server Secure Socket Layer (SSL) configuration file: sudo nano ssl.conf 61. Find the section that says <VirtualHost _default_:443> 62. Insert the following code: ServerName blogger.teo-en-ming.com Redirect / https://tdtemcerts.blogspot.sg Alternative Code: ServerName wordpress.teo-en-ming.com Redirect / https://tdtemcerts.wordpress.com 63. Restart the Apache web server process: sudo /usr/sbin/apachectl restart 64. Test https://blogger.teo-en-ming.com. It should redirect to https://tdtemcerts.blogspot.sg 65. Alternative test: https://wordpress.teo-en-ming.com. It should redirect to https://tdtemcerts.wordpress.com 66. USEFUL REFERENCES: (A) Article: Install Apache and PHP on CentOS 6 Link/URL: https://support.rackspace.com/how-to/centos-6-apache-and-php-install/ (B) Article: How To Create Temporary and Permanent Redirects with Apache and Nginx Link/URL: https://www.digitalocean.com/community/tutorials/how-to-create-temporary-an… 67. Exit Putty/SSH client. 68. END OF TUTORIAL. ===BEGIN SIGNATURE=== Turritopsis Dohrnii Teo En Ming's Academic Qualifications as at 30 Oct 2017 [1] https://tdtemcerts.wordpress.com/ [2] http://tdtemcerts.blogspot.sg/ [3] https://www.scribd.com/user/270125049/Teo-En-Ming ===END SIGNATURE===

3 2

Re: [CentOS] Mail has quit working
by Richard 31 Aug '18

31 Aug '18

> Date: Monday, August 27, 2018 09:57:01 -0400 > From: TE Dukes <tdukes(a)palmettoshopper.com> > >> From: CentOS [mailto:centos-bounces@centos.org] On Behalf Of >> centos--- via CentOS >> Sent: Monday, August 27, 2018 9:31 AM >> >> On 08/27/2018 09:05 AM, TE Dukes wrote: >> > >> > >> > Thanks again! I still think it's a mail issue. I can't get mail >> > using usermin either. >> > >> > Think I'm going to remove the TLS stuff from postfix main.cf >> > that I added yesterday and retry. >> >> If I missed this further up thread my apologies - is SELinux >> enabled and are there any relevant exceptions being logged? > > Pretty sure SELinux is turned off unless it got turned on without my > knowledge through an updtate/upgrade. > > I removed the TLS lines from main.cf I added last night and > remotely did a reboot from here at work. > > Mail is again working!! I am skeptical to mark this thread solved > as I thought it was solved back in July. > > I think, removing my ISP's DNS servers from resolve.conf was the > fix, could be removing IPV6 from etc/hosts. Might put it back in > just to see. > As I indicated earlier, removing those lines from your postfix config will have no impact on your ability to reach your roundcube instance. Unlike the windowz world, you mostly don't need to "reboot" a machine after making changes to a service (e.g., your postfix config change). An unnecessary reboot can bring in many issues so makes debugging a problem difficult. Instead, restart the service in question (often a reload is all that's needed, but a service restart generally doesn't hurt in a single/lower user environment). Unless you are VPN-ing (or equiv) my sense is that you are currently getting to your mail (roundcube) from outside your network. Earlier, when it wasn't working, my sense was that you were inside. If that's true you can't really tell if your issue has been resolved as you are coming at things from different network directions.

3 5

missing CESA-2018:2571 Important CentOS 6 bind Security Update
by Ulf Volmer 30 Aug '18

30 Aug '18

Hello, i'm running bind on an up to date CentOS 6.10 and missing the bind update from the announcement above. [root@fw ~]# yum list bind Loaded plugins: fastestmirror Loading mirror speeds from cached hostfile * epel: ftp.nluug.nl Installed Packages bind.x86_64 32:9.8.2-0.68.rc1.el6 @base is there is something wrong on my side? Or with the CentOS- repo? (My repo config is on https://cloud.u-v.de/index.php/s/ksNcosfmBrN57SQ ) best regards Ulf

3 3

SecureBoot : rolling out new shim pkgs for CentOS 7.5.1804 in CR repository - asking for testers/feedback
by Fabian Arrotin 30 Aug '18

30 Aug '18

When we consolidated all CentOS Distro builders in a new centralized setup, covering all arches (so basically x86_64, i386, ppc64le, ppc64, aarch64 and armhfp those days), we wanted also to add redundancy where it was possible to. The interesting "SecureBoot" corner case came on the table and we had to find a different way to build the following packages: - shim (both signed and unsigned) - grub2 - fwupdate - kernel The other reason why we considered rebuilding it is that the cert we were using has expired : curl --location --silent https://github.com/CentOS/sig-core-SecureBoot/raw/master/CentOS_7/kernel/SO… | openssl x509 -inform der -text -noout|grep -A2 Validity While technically it doesn't really matter for Secureboot itself, it was better to get a new key/cert rolled-in and use the new one for new builds. That's where it's interesting as because shim embeds the certs in the Machine Owner Key (MOK), and that each other component used in the boot chain is validated against that (so grub2 first, then kernel and kernel modules) that means that once deployed , the new shim would not be able to boot previous grub2/kernel. But there is a solution for that : instead of "embedding" only the new cert, we can have both the old one and new one, permitting us to still boot older kernels but also the new ones we'll build/push soon (built on the new build system), and that's what we used for that new shim package. That's where we'd like you (SecureBoot users) to give us feedback about that new shim pkg. It was already validated on some hardware nodes, passed some QA tests, but we'd prefer to have more feedback. Worth noting that such rebuild has also a patch that should fix an issue we had with shim not allowing to import key in MOK through mokutil (see https://bugs.centos.org/view.php?id=14050) How can you test ? If you're using UEFI with SecureBoot enabled , we have signed/pushed those pkgs to the CR repository (see https://wiki.centos.org/AdditionalResources/Repositories/CR) That repo is by default disabled, but following command would let you update shim : yum update shim --enablerepo=cr Then reboot and it should work like before, so validating the boot chain (while still using grub2/kernel packages signed with previous key) We'd appreciate feedback on this list, or #centos-devel on irc.freenode.net I'd like to thank Patrick Uiterwijk and Peter Jones for their help for the patch and validation for that shim -- Fabian Arrotin The CentOS Project | https://www.centos.org gpg key: 56BEC54E | twitter: @arrfab

1 0

Re: [CentOS] Stuck on loading of CentOS
by Dhanasekaran Balakrishnan 30 Aug '18

30 Aug '18

Hi, Yes nvidia driver is installed in the computer. I am not sure how my colleague did this and presently he is not in my lab. -Dhana -- PhD Student, Bionanoscience and Biochemistry Laboratory (Heddle Lab), Malopolska Center of Biotechnology, Jagiellonian University, Krakow, Poland.

2 1

grub.cfg
by Steffan A. Cline 30 Aug '18

30 Aug '18

I ran into something with a recent batch of updates on CentOS 7. It seems that possibly one of the kernel updates running dracut changed all of the volume groups in the grub.cfg file making the system unable to boot until I manually edited each line putting it back to the way it was originally. My volume group is called vg_h1 but it changed them all to the default “centos”. Is there a config somewhere I need to edit so this never happens again? Steffan A. Cline steffan(a)hldns.com 602-793-0014

2 3

Kickstart file for software raid
by Jerry Geis 29 Aug '18

29 Aug '18

I am using a kickstart file for CentOS 7 raid / --device=md0 --fstype="xfs" --level=1 --useexisting raid /home --noformat --device=md1 --level=1 --useexisting It is erroring out on the --useexisting. The exact text is: RAID volume "0" specified with "--useexisting" does not exist. What did I do wrong? Jerry

2 3

C7, system-auth-ac, and authconfig
by mark 29 Aug '18

29 Aug '18

I read the clear-as-mud docs, and it appears that if we want to modify system-auth-ac, we can create a local, and point system-auth to it. Howver.. in the default, I see auth [success=3 default=ignore] pam_succeed_if.so service notin login:gdm:xdm:kdm:xscreensaver:gnome-screensaver:kscreensaver quiet use_uid Now, we'd like to add sudo to that list. Does anyone know *where* authconfig gets that list in the first place? I haven't been able to find anything yet, and I've been looking. mark

1 0

Remote update OS from 6 to 7
by Jerry Geis 29 Aug '18

29 Aug '18

Hello all... I have a remote machine running C6. I desire to update it to C7. Not possible to be on-site. Can I copy the Everything ISO for C7 to the machine, mount -o loop C7.Everything.iso /media/cdrom then do a "yum upgrade" ? Will that work? The server is using software raid. Thanks Jerry

3 2

CentOS-announce Digest, Vol 162, Issue 5
by centos-announce-request＠centos.org 29 Aug '18

29 Aug '18

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit https://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CESA-2018:2571 Important CentOS 6 bind Security Update (Johnny Hughes) 2. CESA-2018:2557 Important CentOS 7 postgresql Security Update (Johnny Hughes) 3. CESA-2018:2570 Important CentOS 7 bind Security Update (Johnny Hughes) ---------------------------------------------------------------------- Message: 1 Date: Tue, 28 Aug 2018 15:39:55 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2018:2571 Important CentOS 6 bind Security Update Message-ID: <20180828153955.GA34287(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2018:2571 Important Upstream details at : https://access.redhat.com/errata/RHSA-2018:2571 The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: 248124b6482789bfbb5f6e656a98e915769c55168b3d23009652527526e331a8 bind-9.8.2-0.68.rc1.el6_10.1.i686.rpm f1c0a5f60d808dafd3d67b4ce198019bc13632e07f71cefb29a75ebe2af4fd63 bind-chroot-9.8.2-0.68.rc1.el6_10.1.i686.rpm 87bffb7bd45681565d5ef4b18579169f187d4fa66fbec4741c570430ee0c06d2 bind-devel-9.8.2-0.68.rc1.el6_10.1.i686.rpm 2f6f7ac42ca47afd420d62c6f21ef2d4e7d1505fedb6a9a70bc9b2c6461e50d9 bind-libs-9.8.2-0.68.rc1.el6_10.1.i686.rpm 1ed256461a14d8fe827d6aaa3aa46a8e6ed9ce55532aa3c27a5eba1921f06257 bind-sdb-9.8.2-0.68.rc1.el6_10.1.i686.rpm 7e481a255c517a66d7222957ad199ef61455f918f1ba80160ab42a07f1b1f544 bind-utils-9.8.2-0.68.rc1.el6_10.1.i686.rpm x86_64: 960846e8ce3a15bab85789a29ad4e9ac3e9d00b9d9fe158a07ab16eec065fabc bind-9.8.2-0.68.rc1.el6_10.1.x86_64.rpm 09b0b1148ddb2de55b5165b51be9c3c250ccb981fbdc4e01934c8a23a1c4c098 bind-chroot-9.8.2-0.68.rc1.el6_10.1.x86_64.rpm 87bffb7bd45681565d5ef4b18579169f187d4fa66fbec4741c570430ee0c06d2 bind-devel-9.8.2-0.68.rc1.el6_10.1.i686.rpm 0018e4f38542d2d56fa15893ffb5cd34e8023fdc2b30a3b42d28666fe55d946a bind-devel-9.8.2-0.68.rc1.el6_10.1.x86_64.rpm 2f6f7ac42ca47afd420d62c6f21ef2d4e7d1505fedb6a9a70bc9b2c6461e50d9 bind-libs-9.8.2-0.68.rc1.el6_10.1.i686.rpm a885a7dd62446139f83677fde3dc9769ba2990463575cba4e8f4914d7ffa22a5 bind-libs-9.8.2-0.68.rc1.el6_10.1.x86_64.rpm dc3892983716d2275054bbfea53267131b78806cb2926444a8ea6d846193929b bind-sdb-9.8.2-0.68.rc1.el6_10.1.x86_64.rpm baf936fc48052e6ba44bd76af3a14094c0b16c26c92923ff83ffc597a58ed23e bind-utils-9.8.2-0.68.rc1.el6_10.1.x86_64.rpm Source: 8564b64b5870e90091523c0fb7e9bc86d99d43faefafa91132f4be497e8eb259 bind-9.8.2-0.68.rc1.el6_10.1.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net Twitter: @JohnnyCentOS ------------------------------ Message: 2 Date: Tue, 28 Aug 2018 15:47:41 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2018:2557 Important CentOS 7 postgresql Security Update Message-ID: <20180828154741.GA34512(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2018:2557 Important Upstream details at : https://access.redhat.com/errata/RHSA-2018:2557 The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) x86_64: 435c54da90ac6a986123ebeed8a46ca06198945148412400bcc25165b20b0901 postgresql-9.2.24-1.el7_5.i686.rpm 88083a8c3867858fc230fb8e123d1884ad447630af3d0b7cdbc9f415a2cb7691 postgresql-9.2.24-1.el7_5.x86_64.rpm 26607e1d2c701a5a0a8203fc4a4ddd74c3f7d5ed6d9b121753535c673bf3df82 postgresql-contrib-9.2.24-1.el7_5.x86_64.rpm fae26c6c1a2e35d21388f9e9bb601e2e65ebf6ebee491c7879fe3e841c89d2bd postgresql-devel-9.2.24-1.el7_5.i686.rpm 97d1b913fd93b28fedcff9d9889b74a86c1c8fc80619ca2a9f9050cc21a2c840 postgresql-devel-9.2.24-1.el7_5.x86_64.rpm f06e0c08f35f44e82d81c6a953a2095229c5c8ea6a1ed557ed3428b2d982b2a0 postgresql-docs-9.2.24-1.el7_5.x86_64.rpm 5fb3d8e7c46ef84c38761fbf8eb0fa45b3d6bb78271be062d864d7038ce42dcf postgresql-libs-9.2.24-1.el7_5.i686.rpm d8435352291ac2627b65f0a3a65f41906390307cf2300d020dfb793e705cdb06 postgresql-libs-9.2.24-1.el7_5.x86_64.rpm 2a20977c047a2a3e7efef79b589ba8bf95285a5fad766dd485f258d33b8b3201 postgresql-plperl-9.2.24-1.el7_5.x86_64.rpm 8b0d205949e154882da55d7d472489ba7414b856ed59039614b6590c75a45c60 postgresql-plpython-9.2.24-1.el7_5.x86_64.rpm 75fe3d5666368c6f0bc80e64c203b91286f1e4c81ed82bbd5db988b9425fcbbd postgresql-pltcl-9.2.24-1.el7_5.x86_64.rpm 6955c0e9151487a7bde24418fee9af6072916190e1879c20a8ee95623cb56e05 postgresql-server-9.2.24-1.el7_5.x86_64.rpm 2232aae0691e140707437ba1422329bd6193aacb98929508838f8f8a37f062b8 postgresql-static-9.2.24-1.el7_5.i686.rpm a1ec84aeb970a247c7075be4e2e44dc1d1662a5f4ce63b20b65ebd69fad3aeae postgresql-static-9.2.24-1.el7_5.x86_64.rpm 70a4adbd0edfe7f982395b928129e82da3cc6ce4bcee4e30dd395116da1c60b4 postgresql-test-9.2.24-1.el7_5.x86_64.rpm fd8c23fc70230e52d47f56b0ed72325152e59e9dcdb777b55805acef4ac96ce7 postgresql-upgrade-9.2.24-1.el7_5.x86_64.rpm Source: 9fd884c340f9aae296653aff2b30fcc4362acba9912508bb07c8778dc8e78f9e postgresql-9.2.24-1.el7_5.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net Twitter: @JohnnyCentOS ------------------------------ Message: 3 Date: Tue, 28 Aug 2018 15:48:00 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2018:2570 Important CentOS 7 bind Security Update Message-ID: <20180828154800.GA34656(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2018:2570 Important Upstream details at : https://access.redhat.com/errata/RHSA-2018:2570 The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) x86_64: ee4027789eafae8c2855a1702e117ff6dc517820a231df6eab0aed16eece8fab bind-9.9.4-61.el7_5.1.x86_64.rpm 45e7ad9b9c08a7ca8e78b95084a9b61caf86d664290d660c3ee6fd41661058f3 bind-chroot-9.9.4-61.el7_5.1.x86_64.rpm 303502657386d0c4e394811ba56b8d72025c92be2237e2045eb85c2661233807 bind-devel-9.9.4-61.el7_5.1.i686.rpm 1e2110e750b3adb5857904f19167109f418ee1f430f900308f1e009c7c1944d8 bind-devel-9.9.4-61.el7_5.1.x86_64.rpm 44328049069dfe2efbfb2c5e14c10d5482e23d39009eec290032232697d91cbb bind-libs-9.9.4-61.el7_5.1.i686.rpm db10791c7f7966843cd78ec1b71025935d4caee8746b01622068eb8cb404bea2 bind-libs-9.9.4-61.el7_5.1.x86_64.rpm 8850fc3b588e95fc9a72b857cbccfd18093cc1c69b95b85eeec608433964d044 bind-libs-lite-9.9.4-61.el7_5.1.i686.rpm c3fff9b6f6fca10a4fe77653fde96568f6a6353d8bf6fd87d526c45de7bed1a2 bind-libs-lite-9.9.4-61.el7_5.1.x86_64.rpm 2953e193ef6197ac414bf6ed2d15f59e3c85ffb824dd89a06f98189844eb1010 bind-license-9.9.4-61.el7_5.1.noarch.rpm 5c9df998d37413f862f619d0815e3131eba2e172ae63decf0efbeb5259fe633f bind-lite-devel-9.9.4-61.el7_5.1.i686.rpm d77653fd680bfeef0dfd799fe1a8f2f6027e63693108567e3c6bba2474d0cd87 bind-lite-devel-9.9.4-61.el7_5.1.x86_64.rpm 1ef96a7ea43061542dbc97c4c7a2b1d9dc26b002d1593b0980b6027ca343a7aa bind-pkcs11-9.9.4-61.el7_5.1.x86_64.rpm 6f0afbee32b1536325fbdcffccbe81aff3b47d8e2de0dedc981cd393c22120c4 bind-pkcs11-devel-9.9.4-61.el7_5.1.i686.rpm 6e27874eaa335a46cede258f11e23ad20e8ef7678886698d275cd7c3e8bfc8d9 bind-pkcs11-devel-9.9.4-61.el7_5.1.x86_64.rpm 971f7b0c47c778862444dffafc36616cb7dba597af7e721d8ab9e92e0be8e2ce bind-pkcs11-libs-9.9.4-61.el7_5.1.i686.rpm a865deb5b2c4771820fdbdea2e42a01a891644d6ed9ca0a06fb532142c411044 bind-pkcs11-libs-9.9.4-61.el7_5.1.x86_64.rpm 65d05f02bdf025e23ea9d9142e3255432ec39c5c6b29e5fe6920dfd665bf8b99 bind-pkcs11-utils-9.9.4-61.el7_5.1.x86_64.rpm 790f90103359863a59b552100ba8a3c03067795bab42fb518625fa54143e66ca bind-sdb-9.9.4-61.el7_5.1.x86_64.rpm a3bbb400e22a538a3c2b98e8a241714d58fb2713e2f3bb6a2f140068b606283f bind-sdb-chroot-9.9.4-61.el7_5.1.x86_64.rpm 3c474addd9b809ec82d7d8f9cad68ea950b658d43c2a362fc4ffe94ad2e3f12d bind-utils-9.9.4-61.el7_5.1.x86_64.rpm Source: 3b9245b26b6677828475193eface9f2e30c478bf3b38f37e507398b04e082b8c bind-9.9.4-61.el7_5.1.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net Twitter: @JohnnyCentOS ------------------------------ Subject: Digest Footer _______________________________________________ CentOS-announce mailing list CentOS-announce(a)centos.org https://lists.centos.org/mailman/listinfo/centos-announce ------------------------------ End of CentOS-announce Digest, Vol 162, Issue 5 ***********************************************

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss